Skip to content

Version 26.10.1.1

What's new

Access rights transfer for data mart views

When the transfer of access rights is enabled on a data source, it no longer touches the definition of the data mart object: the object is created exactly from the generated SQL shown in the DDL script, and the rights are then applied to the object itself. A regular view grants read access only to the users and roles that may read all of its sources and lets the database apply the source column restrictions and row-level security policies to every reader. A table grants each user or role access only to the columns they are allowed to read, gets the row-level security policies of its source recreated on it and, on Microsoft SQL Server, receives the source masks as well. When a policy cannot be carried over to the object, the users and roles it restricts are denied access to the object, so security always comes first. Materialized views are unavailable while the transfer is on, because a stored snapshot cannot be filtered for each reader: the "Materialized view" option is shown disabled with a tooltip suggesting a regular view or a table instead. The "Access rights to be transferred" preview now shows who gets access to which subset of columns, which columns are restricted and for whom, which columns are masked and how each row-level security policy is applied — enforced by the database, created on the object or by denying access to the restricted users; the preview is informational and never blocks deployment. The "Transferred access rights" tab of the view details dialog gained an "Applies to" column, so every row-level policy is listed with its name and condition together with the users and roles it applies to. When a user shows the data of a view under their personal database credentials, only the columns granted to that account are selected; if the account holds no rights on the object, the message "You do not have sufficient permissions to access the requested data in the database" is shown and the status of the object does not change. A missing privilege of the account running a query in the target database is now reported as exactly that, with the advice to contact the database administrator.

Improvements and bug fixes

  • When identity providers are configured, the first sign-in step remembers the email addresses that have already signed in successfully in this browser and offers them in a dropdown; any address can be removed from the list, and the "Another user?" link switches back to typing an address (IMP-3173)
  • The step for signing in with the DataForge password now has a "Return to sign-in options" button, and on sign-in screens with a single primary button pressing Enter works the same as clicking it (IMP-3173)
  • Identity providers are no longer configured by email domains: a provider is offered only to the users of its own company, whereas previously a provider without domains was shown to users of every company (IMP-3173)
  • The dialogs for adding a company and for adding users on the user list, company details and "My company" screens now follow the same layout as the dialog for adding members to a project, and a company can now be created without adding any users to it (IMP-3148)
  • A changed project description is now shown immediately after saving and is carried over to a new project created by cloning (IMP-2910)
  • Canvases such as lineage, the formula builder and impact analysis use noticeably fewer resources: an idle canvas no longer redraws itself continuously, and dashed connection lines stay static instead of being animated (IMP-2948)
  • Selecting the "IN" or "NOT IN" operation in a verification filter of a fact table no longer resets the value already entered in the filter (IMP-3012)
  • Expanding a dimension group on the data mart canvas now shows its dotted lines every time, a group expanded for the first time appears in view next to the fact table it was expanded from, and a group that was moved stays in place after the data mart is saved (IMP-3132)
  • A data mart view is now marked as stale in every case that affects its data: when a row is deleted in the RMD, when keys are changed in the fact table architect, when a formula or a source that a measure, dimension or fact depends on is changed, and when such changes are made through the public API (IMP-3154)
  • The status of a data mart view now changes in line with the action performed when the view is created, updated or deleted, instead of briefly flipping between states (IMP-3156)
  • When showing a data mart view fails, the error is now displayed in a notification and the "Execute SQL script" button stops loading and can be clicked again, instead of loading indefinitely (IMP-3195)
  • A PostgreSQL connection now loads the schema list of the database selected in the connection, even when it differs from the database of the data source, the check verifies the selected database and schema, and the connection can no longer be saved without a schema (IMP-3186)
  • In on-premises installations, primary dimensions and facts — including those in fact tables and data marts — no longer show errors that disappear only after the connection is updated (IMP-3251)
  • The OPENINGVALUE and CLOSINGVALUE filters accept an optional second parameter that limits how many days back the value is looked up, for example {OPENINGVALUE([Date],7)}: OPENINGVALUE accepts 1 to 32767 (1 means only the previous date) and CLOSINGVALUE accepts 0 to 32767 (0 means only the last date of the period); without it, all available data is searched as before, and the formula editor and the formula builder check the value (IMP-3258)
  • The OPENINGVALUE and CLOSINGVALUE filters now return values for all items, not only for those with rows inside the selected period — for example, a product whose last stock record is dated before the period now gets its opening balance instead of being missing from the data mart (IMP-3258)
  • Users with the Viewer role can now open the editing screens of fact tables, verification filters and data marts read-only: move objects on the data model, fact table and data mart canvases, show measure dependency lines, open the filter and aggregation level settings and the data mart view menu, generate, view, copy and export SQL scripts, show a data mart view with a result limit, and open the view details and the update rule editor (IMP-3260)
  • For the Viewer role, buttons that save changes or change the database — such as [Save], [Execute SQL script], [Check sources], [Update view] and [Add rule] — are shown disabled with a tooltip explaining why, and the server rejects these actions for viewers as well (IMP-3260)